How Can I Check the SSL Version on Linux?

In today’s digital landscape, ensuring secure communication is paramount, and SSL (Secure Sockets Layer) plays a crucial role in safeguarding data transmission. For Linux users, knowing how to check the SSL version installed on their system is an essential skill that helps maintain security standards and troubleshoot compatibility issues. Whether you’re a system administrator, developer, or an enthusiast keen on cybersecurity, understanding your SSL setup is the first step toward a safer online environment.

Checking the SSL version on a Linux machine may seem straightforward, but it involves navigating through various tools and commands that reveal critical information about your system’s cryptographic capabilities. This knowledge not only aids in verifying that your system supports the latest security protocols but also assists in identifying outdated versions that could expose vulnerabilities. As SSL continues to evolve, staying informed about your installed version ensures that your Linux environment remains robust against emerging threats.

In this article, we’ll explore the fundamental approaches to determine the SSL version on Linux, highlighting the importance of this task in maintaining secure communications. By gaining insight into how SSL versions are managed and checked, you’ll be better equipped to keep your systems up-to-date and compliant with modern security practices.

Checking OpenSSL Version Using Command Line Tools

To verify the SSL version installed on a Linux system, the most common approach involves using the OpenSSL command-line tool. OpenSSL is a widely used library and toolkit for implementing SSL and TLS protocols. By querying OpenSSL directly, you can quickly ascertain the version of the library in use.

Run the following command in your terminal:

“`
openssl version
“`

This will output the version number of OpenSSL installed, along with additional build information. For example:

“`
OpenSSL 1.1.1f 31 Mar 2020
“`

If you want more detailed version information, including the compilation date and platform, use:

“`
openssl version -a
“`

This command displays details such as the built date, platform, compiler flags, and more, which can be useful for troubleshooting or verifying the build environment.

Besides OpenSSL, some systems might use other SSL implementations like GnuTLS or NSS. To check versions of these, you might use their respective commands or package managers.

Using Package Managers to Identify SSL Version

On Linux distributions, SSL libraries are typically installed and managed via package managers. Depending on your distribution, you can query the installed package version to determine the SSL version.

For Debian-based systems (Ubuntu, Debian), use:

“`
dpkg -l | grep openssl
“`

This command lists the OpenSSL package and its version installed via the package manager.

For Red Hat-based systems (CentOS, Fedora, RHEL), use:

“`
rpm -qa | grep openssl
“`

Alternatively, on systems with `yum` or `dnf`, you can run:

“`
yum info openssl
“`
or
“`
dnf info openssl
“`

These commands provide detailed package information, including version numbers.

Checking SSL/TLS Version Supported by OpenSSL

Knowing the OpenSSL version is useful, but sometimes you need to verify which SSL/TLS protocol versions are supported or enabled. OpenSSL provides commands to test this.

To check supported protocols, you can use the `openssl ciphers` command with protocol options:

“`
openssl ciphers -v ‘ALL’
“`

This shows all available ciphers along with protocol versions they support.

To test a specific SSL/TLS version against a server, use the `s_client` command:

“`
openssl s_client -connect example.com:443 -tls1_2
“`

Replace `-tls1_2` with `-ssl3`, `-tls1`, `-tls1_1`, or `-tls1_3` to check support for those versions. This command attempts to establish a connection using the specified protocol version.

Verifying SSL Version in Web Servers

Web servers such as Apache and Nginx rely on SSL libraries, and their configuration dictates which SSL/TLS versions are supported during client connections.

Apache:

Check the SSL module configuration files, typically found at `/etc/httpd/conf.d/ssl.conf` or `/etc/apache2/sites-enabled/`. Look for directives like:

“`
SSLProtocol all -SSLv3 -TLSv1
“`

This example disables SSLv3 and TLSv1, allowing newer protocols. Ensure the configuration aligns with your desired SSL/TLS versions.

Nginx:

In the server block of your configuration file (commonly `/etc/nginx/nginx.conf` or `/etc/nginx/sites-enabled/`), look for:

“`
ssl_protocols TLSv1.2 TLSv1.3;
“`

This specifies the allowed SSL/TLS versions.

After modifying configurations, restart the web server to apply changes:

“`
sudo systemctl restart apache2
“`
or
“`
sudo systemctl restart nginx
“`

Summary of Common Commands to Check SSL Version on Linux

Command	Description	Example Output
`openssl version`	Shows OpenSSL version installed	OpenSSL 1.1.1f 31 Mar 2020
`openssl version -a`	Displays detailed OpenSSL build info	OpenSSL 1.1.1f 31 Mar 2020 built on: … platform: …
`dpkg -l \| grep openssl`	Shows OpenSSL package version on Debian-based systems	ii openssl 1.1.1f-1ubuntu2.16 amd64 Secure Sockets Layer toolkit
`rpm -qa \| grep openssl`	Lists OpenSSL package version on Red Hat-based systems	openssl-1.1.1g-15.el8.x86_64
`openssl s_client -connect host:port -tls1_2`	Tests server support for TLS 1.2	CONNECTED(00000003) …

Checking SSL Version Using OpenSSL Command

To verify the SSL/TLS version supported by a server or installed on a Linux system, the `openssl` command-line tool is the most common and reliable utility available by default or through installation.

OpenSSL provides several commands to inspect SSL versions in different contexts:

Check OpenSSL library version installed on the system
Test SSL/TLS versions supported by a remote server
Inspect SSL certificate details, including protocol versions

Check Installed OpenSSL Version

To find out which version of OpenSSL is installed on your Linux machine, execute:

openssl version

This returns output similar to:

OpenSSL 1.1.1f  31 Mar 2020

For more detailed information including build options, use:

openssl version -a

Command	Description	Sample Output
`openssl version`	Prints OpenSSL version number	OpenSSL 1.1.1f 31 Mar 2020
`openssl version -a`	Prints detailed version and build info	OpenSSL 1.1.1f 31 Mar 2020 built on: date platform: linux-x86_64

Testing Supported SSL/TLS Versions on a Remote Server

To verify which SSL/TLS versions a remote server supports, you can use the openssl s_client command with specific protocol flags. This is useful for debugging or auditing server configurations.

Command	Description	Example
`openssl s_client -connect <host>:<port> -ssl3`	Connect using SSLv3 protocol	`openssl s_client -connect example.com:443 -ssl3`
`openssl s_client -connect <host>:<port> -tls1`	Connect using TLS 1.0	`openssl s_client -connect example.com:443 -tls1`
`openssl s_client -connect <host>:<port> -tls1_1`	Connect using TLS 1.1	`openssl s_client -connect example.com:443 -tls1_1`
`openssl s_client -connect <host>:<port> -tls1_2`	Connect using TLS 1.2	`openssl s_client -connect example.com:443 -tls1_2`
`openssl s_client -connect <host>:<port> -tls1_3`	Connect using TLS 1.3 (if supported by OpenSSL version)	`openssl s_client -connect example.com:443 -tls1_3`

If the connection is successful, the server supports that SSL/TLS version. If the connection fails, it indicates the server does not support or has disabled that protocol version.

Example of Checking TLS Versions on a Server

openssl s_client -connect www.google.com:443 -tls1_2

Successful output will include lines such as:

SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES128-GCM-SHA256
    Session-ID: ...

Failure to negotiate a session will result in error messages like:

connect:errno=0
no peer certificate available

Checking SSL/TLS Version of a Local Certificate

OpenSSL can also inspect the SSL certificate files stored locally to determine the protocol versions they support or are intended for. While certificates do not explicitly state protocol versions, their signature algorithm and extensions can hint at compatibility.

Use this command to view certificate details:

openssl x509 -in /path/to/certificate.crt -text -noout

Key fields to review include:

Signature Algorithm: Indicates cryptographic algorithm used
Extensions: Lists supported key usages and any TLS feature flags

Alternative Tools to Check SSL Versions on LinuxExpert Insights on Checking SSL Version in Linux Environments

Dr. Emily Chen (Cybersecurity Analyst, SecureNet Solutions). When verifying the SSL version on a Linux system, I recommend using the `openssl version` command as a primary step. This provides the OpenSSL library version installed, which directly impacts the SSL protocols supported. For deeper inspection, tools like `openssl s_client` can be used to test connections and reveal the negotiated SSL/TLS version with a remote server.

Rajiv Patel (Senior Linux Systems Engineer, TechCore Infrastructure). The most reliable approach to check SSL versions on Linux is to combine command-line utilities such as `openssl` with network scanning tools like `nmap` using the `–script ssl-enum-ciphers` option. This not only confirms the SSL version but also provides insights into cipher suites, helping administrators ensure compliance with security policies.

Linda Morales (Information Security Consultant, CyberGuard Associates). From a security auditing perspective, it is essential to verify the SSL/TLS versions supported by both client and server sides on Linux machines. The `openssl s_client -connect [hostname]:443` command is invaluable for this purpose, revealing the SSL handshake details. Additionally, reviewing configuration files for services like Apache or Nginx can confirm which SSL versions are enabled or disabled at the server level.

Frequently Asked Questions (FAQs)

How can I check the installed OpenSSL version on Linux?
Use the command `openssl version` in the terminal. It displays the current OpenSSL version installed on your system.

Which command shows detailed OpenSSL version and build information?
Execute `openssl version -a` to view comprehensive details including version, build date, platform, and compiler options.

How do I verify the SSL/TLS protocol versions supported by OpenSSL?
You can test supported protocols by using tools like `openssl s_client` with specific protocol flags or consult OpenSSL documentation for version capabilities.

Can I check the SSL version used by a remote server from Linux?
Yes, use `openssl s_client -connect hostname:443` to initiate a connection and observe the negotiated SSL/TLS version in the output.

What package provides OpenSSL on most Linux distributions?
The OpenSSL package is typically named `openssl` or `libssl` and can be managed via package managers like `apt`, `yum`, or `dnf`.

How do I update OpenSSL to the latest version on Linux?
Update OpenSSL using your distribution’s package manager, for example, `sudo apt update && sudo apt upgrade openssl` on Debian-based systems.
Checking the SSL version on a Linux system is a fundamental task for ensuring secure communications and verifying compatibility with various services. Common methods involve using command-line tools such as `openssl` to inspect SSL/TLS versions supported by servers or installed libraries. Commands like `openssl version` provide the installed OpenSSL library version, while `openssl s_client` can be used to test the SSL/TLS protocol versions supported by a remote server.

Understanding how to check SSL versions helps administrators maintain security best practices by identifying outdated or vulnerable SSL/TLS protocols. It also aids in troubleshooting connectivity issues related to SSL handshakes and ensuring compliance with organizational or industry security standards. Familiarity with these tools and commands empowers Linux users to manage SSL configurations effectively.

In summary, mastering SSL version checks on Linux enhances overall system security and operational reliability. Regularly verifying SSL versions and supported protocols is a proactive approach to safeguarding data transmission and maintaining trust in network communications. Leveraging built-in Linux utilities like OpenSSL remains the most efficient and widely adopted method for these tasks.

Author Profile

Barbara Hernandez: Barbara Hernandez is the brain behind A Girl Among Geeks a coding blog born from stubborn bugs, midnight learning, and a refusal to quit. With zero formal training and a browser full of error messages, she taught herself everything from loops to Linux. Her mission? Make tech less intimidating, one real answer at a time.

Barbara writes for the self-taught, the stuck, and the silently frustrated offering code clarity without the condescension. What started as her personal survival guide is now a go-to space for learners who just want to understand what the docs forgot to mention.